danabot | 504511b22308827894ca20fbd50bbf5dd45345391eb117eace44aacd67c2953f

Resubmissions

28/02/2025, 16:11

250228-tna9aa1vbv 1

28/02/2025, 16:04

250228-th4cwaskx3 10

Analysis

max time kernel
391s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2025-02-27 7.16.15 PM.png
Size

113KB
MD5

5c9c2ae01e42fb74dd198e9a9233cb83
SHA1

ab1deda77154ec4067198d1939f084b62daf61f3
SHA256

504511b22308827894ca20fbd50bbf5dd45345391eb117eace44aacd67c2953f
SHA512

7160c5cb3a49b4461907ea8c566fe1519b8005e7cd323550e457e757a418ed096c003fe3f56b80f1584bd8a64909f514642ad6307840ba6b5c2f521711fc3739
SSDEEP

3072:fZV+gCgOdAxKhWDqV2Y4leJqMAnzPXiMwL:8nWDu27lgAzPLm

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0007000000023fe6-958.dat	family_danabot

Blocklisted process makes network request 4 IoCs

flow	pid	Process
181	2020	rundll32.exe
186	2020	rundll32.exe
187	2020	rundll32.exe
188	2020	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
4420	regsvr32.exe
4420	regsvr32.exe
2020	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	700	WerFault.exe	174

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopPuzzle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e3e61bd78f81db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{78A55A69-F5EE-11EF-BCE7-4E39D933DBD5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133852323439172929"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3564	mspaint.exe
3564	mspaint.exe
2752	chrome.exe
2752	chrome.exe
5732	msedge.exe
5732	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe
5136	msedge.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3564	mspaint.exe
3564	mspaint.exe
3564	mspaint.exe
3564	mspaint.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
3280	OpenWith.exe
5424	iexplore.exe
5424	iexplore.exe
396	IEXPLORE.EXE
396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1064	2752	chrome.exe	122
PID 2752 wrote to memory of 1064	2752	chrome.exe	122
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2188	2752	chrome.exe	123
PID 2752 wrote to memory of 2016	2752	chrome.exe	124
PID 2752 wrote to memory of 2016	2752	chrome.exe	124
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125
PID 2752 wrote to memory of 996	2752	chrome.exe	125

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2025-02-27 7.16.15 PM.png"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9210cc40,0x7fff9210cc4c,0x7fff9210cc58
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4928,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5240,i,10586179530148848347,1416523560903488013,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  PID:5764

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff90fe46f8,0x7fff90fe4708,0x7fff90fe4718
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,11619002448432600820,7249766365539026469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5388

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:700
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.exe@700
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4420
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 460
  2⤵
  - Program crash
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 700 -ip 700
1⤵
PID:5984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.dll
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5424
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5424 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:396

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4427aa34d462a7c8911d2f4ffb80f59b

SHA1
90042dcf3e24537a0b75120ca63b44e3e0f6bb01

SHA256
7ca4ce2e6a6603679192e325843ae2565fbc20e2e9f16f400a3f8e67974c5c0b

SHA512
8b3b41eb3b25fc498129671ca8ddba6562c0ab2e67c0b5753c4706e142ea0a1a253173d40e80db22a45dc183dd424c2c4a0c79ab68e28da81a45cb66554ae585

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9228d559389f3ae7dc13ef87147a9d6d

SHA1
860f00fadfe475820fdef06c53338a3afa90bf51

SHA256
4e58e3d1f2eea8ed5946d30e7b868c29ed32266bbdaaa7c2b28ec62165486aab

SHA512
8bc95f79eaf5a04f2692878db788215c33a9e0842f59918dd8fd794ef6f8b6f2f3022b76214dfc284a7e3ae7bef963ae02c4343b3e3008d4f3a45c3c6d58c9bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
8681ed114cf7920fc53d1d5bf5a4532c

SHA1
44bccff76f527395d4542b8e059c16dc24737141

SHA256
822d5ac37c17a6a6c620378c682f1257601ac717f4b014dd4ebb492adb9eb4b0

SHA512
0927a239e70b5fe1dcd1f1da24b9635cf0d61a2f3a42dbc368472eb24f33693d71c8a09ce27c510a27a77d50cf9310d9e4b2a322dddfd782c7f375c3d0306dfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
824c82735e5ac77e8de9fb7e3c411bc8

SHA1
bd1781684f8fd4163cd67a3c365ed82e24d9a7c1

SHA256
cd1c5d0e066418ad06c22e994b4b173056914d8dc3420c64ff2e13d2266be415

SHA512
a96d7ce879c1bfc86ed0d045418ea234d4bdc309daddb7747033a5a5dd727339987676b03ec2491b9373df4e09383c15c5b5a6cfc3f9cbdb4baef6b8de684ccc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a9cec3e1c10ac5fe78d9c41dccdc2936

SHA1
57def9e8094cd4b9eaefbc6716afc27d9f7c1818

SHA256
2d593ec4dc7df42f1aa15052c88dd226e50e2688e3933c8c348bcf53e173835b

SHA512
f8d053185b6be5b5a9e23ce712e45a9c13114ea15fa01c655ecd943e11bce5da3ba5deb4511e916e4c1b4f1c67b43890f6784739599aa3e35d143ac47c8bc1b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f5bb91b594cb0245d461e93aa504c35f

SHA1
196780e8e78ae2f6b0fde5f15b600a6918d32726

SHA256
430d672f90dfb82618c0298630632b8dfa39e251325ec09f1547f91a3c0ed8ad

SHA512
d7f13944e16b3a3593585d1b7e7698a669e9a156e27f7eab08d197d783dba42f5d3b9e2456ca03f4ad109e16d236220b32619bd98ff9b134779f0fdf88cad814

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
244KB

MD5
e6db9c68c3bd6bce53dfa295bdfca6f9

SHA1
8dce52759b495b1c9cd7dffe910673be7c12247d

SHA256
e2fa15795aad3ddfa0420b3d7986530216a0ab3f2b185427e5b15973dd7f8a82

SHA512
24ae7f2901289b17eec0b2b29c49ae4db1414f6275360d8774b4ae74b833f4d83b39992ef0e014bf45fd7d607020ef4fdcfbc5778572a903f8c3be3015580e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
240caa117d6e753ac0401761960ac98b

SHA1
41803a5383332448d3267dd8f60391b4d5432815

SHA256
0df2c900f5c17d14428022ad46611bcede4a0661912d589d36d961d26893d9d1

SHA512
940ca4b433e07edf963c8d3b5fd703a897d9997256bb3147868c3c480bd2612a0ead7a506d3f1d8eff2249af470df68bd585bce3cd122d125669ee0c941b21b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
865B

MD5
eda04d6d3491a6f307bb4a9acc5f9a31

SHA1
c5125d62f0b8a5ce265354b4abb45ce609a0b920

SHA256
753df09ddbca1df76870ed93cad471c5a479463cabd29804c48a7278ab776adf

SHA512
f9561e1cf1803a2ab2da9db0a848e39ce2772a3d62f4b1b7661e8f74e3a31b91dafe5f035253ae652e05aa2d2f43a39b9955ac1b2510dad0630e9c6ad5b6aba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a610b52b6998b5096c5d5647c537d996

SHA1
ea6a4a92c59caf6517ae1afff1fbc46a4795e1ec

SHA256
15153a36503dfc5d902321778e5f905ead86e7be28473065747332245537a806

SHA512
1373461ccd9a9ff6d5a52efd7034580c73c7936a34c7a252dac036838fd921cc324759902b06592a99957110d7c86dba540ffe7b63feb27dabfedd12b7c6d44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0182b315ef027ffce96c363f6bf14b89

SHA1
ff35690311ec97dda2f8a1e63d5a0f5f33ca1fbe

SHA256
806023c3b4770a35c5452fa5bfb18ec8e23026d6cee5e045489176b43a972608

SHA512
7818e16fecc93e619c12c92e6908f162ed091ada0206e61aa2b34057648b876b396814566e57ff82f7f1527f98fa7ee55ae56c514baad79538f3b015bb79b8ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff101d09a4600f4a61781ef299d40cb3

SHA1
af70061e848fd26cb94f80b2587b49edf59ac27a

SHA256
214f189fea9e27103d7fd8758accecc244f6add6306dcab9e3f9eb6dafb37027

SHA512
25763a6f8aaea09fa291843a463566daa7a817321c6552b5a48ba9634b5ae97ed8dcf6f7377330121daa5878f2fe30cadfd0f3077f2e6cb2b98d20a916c60304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c788b194c5fca2e58fc765738fc4b25

SHA1
f5fb6fb7de2cf0fee64166cfa87f35c4255ce4fb

SHA256
c9bbfe540d856bd44b28629e5895a7f28fc0fdbafd5111a1c4859dd1a328974e

SHA512
4d133c946197fa13ffbcc5c6ebef6f711f31dfd5f1f3f54a6fc312dee496cdea709bd91581f99dab7b9d3554cd9922d46609081dfc20799859e0e0f7084216fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37858ed6df2cb66fa1dff9a8cc3a8fe5

SHA1
b0caa63e44035f5a70048a214feafac8c96a3794

SHA256
106fa22bffac7cefa5fbd351f21aebe3984d03b48aec93b74f5f4a8dd311d0bc

SHA512
84eecbfa5b89e385ae84a5c9785f7eb1b1f3304b849bfb9779ba8aa96f51f43c3a28af12f87d31b54bca1e0e88edf95248d630a4f1420073be402568785bc777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6eabefb875a4c52d15ddec2542bdb522

SHA1
e417018a9ccd6b56e02e3ab1b33ae569d38698bb

SHA256
e23d7b473f96036b30373804eea363e9e22cffadf26214300e71d59d921238c5

SHA512
87eca25b60488bdd941481a744be3a27770965905e7db0fa43a21d446d54ff6b381ca97138955be8185de71d697c9afa1c987dbf43374f3d2c79554946d37c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9be965a2ad194795f9fd70f68abca00

SHA1
72fe06f887962b8eb970f67c5b8c73303f6eadfa

SHA256
51b07c6b241f3c1302062d2c01f48423c7cb78a22ce52298c330f3114f8138e0

SHA512
25d0f4337e2557fce62cdaf03137f381dcaa04131479dfce8d98b62ee12e868a49799952ee12f41d022bf589dc7481482f446ae475419beaf287c2f4776cdd05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59bf7e.TMP

Filesize
1KB

MD5
372938a1a99773338ea0e6e9e1b3a3b6

SHA1
936b109ce5912e4f396949ab04edee6fe4e14436

SHA256
b61daa5fa7f8812df2fa4402ea837fd1da9f7c48ecde7916828dfd4701e09098

SHA512
b2f42e9fe7504386eb87f9f3e0584c57ec88654a94dada89525c7f942d18781392df9628f37d45e90738c62c32c13ba2cb649b3b5edf2cd54ab65108059d424b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad263a6c-5783-457c-ba0a-562a99ef255a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
912be515aa8ac4c24d8010956f8f0d7f

SHA1
7afd97db1d3f3b52173d8df17f3839a95a2b608d

SHA256
964313c6177738d7a6502c5417eac04ad8fcf19f8ec8a0d3bbb74f3b40c7b02d

SHA512
aaaab8eccb04c66b2668fbd1e9f8dc50ee51f6c8f1722b4c9c8d7608271acf7850e36d99e15e2005315e3742c3b5285e1845389f641bdc38aaf84a9bdb3b5d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c54ad21c071cbf8dc147acc40dd36602

SHA1
73a76c4b3cf192f4edf09bca52be84c49d2577b4

SHA256
4e2b427c1252da9a3cfa379a157c53c75696a6a21c1bbc625563fdfc17915b7c

SHA512
35237ce44ea7ccfb4c73a44b5abacc1cb93f82bb299bc8d33c20aa89b0bcdd319080e47d585a4e65fc126352a162c4daea03a053d860797ef151911b6f370978

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2752_974877788\4a3e626b-b54b-4ad5-beea-8e0df1202395.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2752_974877788\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
memory/700-963-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/1140-983-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-985-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-987-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-989-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-991-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2020-964-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/2020-981-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/4420-961-0x0000000002BC0000-0x0000000002E2B000-memory.dmp

Filesize
2.4MB

Download